Multiple RR types in parallel via Cloudflare DoH (1.1.1.1) with DO bit; AD shows resolver DNSSEC validation.